Application behavior detection method and device

Abstract

An embodiment of the present invention provides an application behavior detection method and device. The method comprises: a first process acquires a detection task, wherein the detection task is a task for detecting a specified behavior of a specified application; a second process detects the specified behavior of the specified application based on a message instruction from the first process; and the first process acquires relevant information about the specified behavior of the specified application based on the detection result of the second process. An embodiment of the present invention is an automated application behavior detection method. By controlling the detection task, it can realize automated, comprehensive, and accurate detection of the specified behavior of a specified application, which is conducive to reverse analysis and behavior monitoring of the application.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computers, and in particular to a method and device for detecting application behavior. Background Art

[0002] With the rapid development of the mobile internet, a wide range of mobile terminal applications have been developed to meet user needs. Many of these applications skirt the boundaries of functionality and content, such as silently downloading and installing irrelevant applications in the background, frequently displaying pop-up ads that cannot be closed, and other such behaviors that are highly disruptive and severely impact the user experience. These applications are collectively referred to as non-standard applications. Driven by self-interest and market competition, these applications employ behaviors that go beyond the acceptable range of devices and users, forcing interaction and harassing users. Others, driven by rushing and shoddy production, fail to meet quality standards. Some even violate national laws, regulations, and internet standards, disseminating illegal and sensitive content. According to the DCCI's 2016 Mobile Phone Security Report, approximately 94.6% of users believe their devices present security risks. These risks are not caused by traditional viruses or attacks, but rather by the non-standard behavior of various applications, which disrupts the user experience and creates a strong sense of psychological insecurity.

[0003] Given the app market's enormous user base, the inadvertent influx and listing of rogue apps, non-compliant advertising, and apps that pose user security risks can significantly harm user interests and the ecosystem's value system. However, current app detection solutions, such as antivirus scanning, compatibility testing, and manual review, are severely inadequate.

[0004] The antivirus scanning detection solution uses static scanning to scan the apps on the shelves. Its main goal is to detect viruses and malicious code, not irregular behaviors. It is inconsistent with the irregular application inspection in terms of technology (static scanning) and purpose.

[0005] The compatibility test detection scheme has different divisions between application compatibility and functionality. Compatibility testing cannot cover functional testing. For example, behaviors such as difficulty in uninstalling and multiple icons appearing after installation cannot be judged through compatibility testing.

[0006] Manual re-inspection is based on a set of application listing requirements of each application market, and manually checks the applications to be listed. However, due to the differences in the requirements of each application market, there are certain differences in the focus, type classification, and detection granularity. At the same time, there are certain differences in the understanding and manual operation of the requirements among testers, resulting in a large number of non-standard applications being put on the shelves.

[0007] Therefore, a new technology is urgently needed to solve the problem of detecting irregular behavior of current applications. Summary of the Invention

[0008] In response to the problems existing in the existing technology, the embodiments of the present invention provide an application behavior detection method and device, which can make up for the shortcomings of current antivirus scanning, compatibility testing, manual re-inspection and other detection methods. It can not only automatically and comprehensively detect the irregular behavior of applications, but also detect any specified behavior, which is conducive to reverse analysis and behavior monitoring of applications.

[0009] In a first aspect, an embodiment of the present invention provides an application behavior detection method, comprising:

[0010] The first process acquires a detection task, where the detection task is a task for detecting a specified behavior of a specified application program;

[0011] The second process detects a specified behavior of the specified application according to the message instruction of the first process;

[0012] The first process obtains relevant information of the specified behavior of the specified application according to the detection result of the second process.

[0013] Furthermore, the first process obtains the detection task, specifically including:

[0014] The first process reads a local file and obtains a detection task from the local file; or the first process receives a detection task sent by the server;

[0015] The designated application corresponding to the detection task is an installed application or an uninstalled application.

[0016] Furthermore, the second process detects a specified behavior of the specified application according to the message instruction of the first process, and the method further includes:

[0017] The first process obtains one or more detection items and a detection time corresponding to each detection item according to the detection task;

[0018] The first process maintains a timer based on the acquired detection items and detection time, and configures a detection phase for each detection item;

[0019] Based on the detection stage corresponding to any detection item of the detection task, the first process sends a first global message or a second global message, wherein the first global message is used to indicate the start of detection of any detection item, and the second global message is used to indicate the end of detection of any detection item.

[0020] Furthermore, the second process detects a specified behavior of the specified application according to the message instruction of the first process, specifically including:

[0021] If the second process receives the first global message, the second process hooks the page creation method of the specified application and simulates clicks on the page of the specified application to traverse page operations; the second process obtains page information of each refresh as data to be detected; based on the detection phase corresponding to the first global message, the second process performs behavior detection based on the data to be detected; or

[0022] If the second process receives the second global message, it ends the detection of the specified application and sends a third message to the first process. The third message includes the actual detection time and detection content of the detection phase corresponding to the second global message.

[0023] Furthermore, the second process hooks the page creation method of the specified application, simulates clicks on the page of the specified application to traverse the page operation, and further includes:

[0024] The second process obtains an input instruction;

[0025] The second process executes one or more Hook events according to the input instruction.

[0026] Furthermore, the second process hooks the page creation method of the specified application, simulates clicks on the page of the specified application to traverse the page operation, and further includes:

[0027] The second process records information about the current page of the simulated click and the clicked control to ensure that the page can be returned to after the jump occurs, thereby completing the page traversal operation.

[0028] Furthermore, in the detection phase corresponding to the first global message, the second process performs behavior detection based on the data to be detected, specifically including:

[0029] The second process filters the data to be detected according to the detection phase corresponding to the first global message to obtain filtered data to be detected;

[0030] If the filtered data to be detected contains the specified detection content, the second process performs behavior analysis and detection on the filtered data to be detected to detect the specified behavior of the specified application.

[0031] Furthermore, the second process performs behavioral analysis and detection on the filtered data to be detected, specifically including:

[0032] The second process performs one or more of in-application detection, background detection, and out-application detection on the specified behavior of the specified application based on the filtered data to be detected;

[0033] The in-application detection refers to the detection of specified behaviors that occur during the operation of the application; the background detection refers to the detection of specified behaviors that occur during the background operation when the application switches to the background; the out-application detection refers to the detection of specified behaviors related to the application after the application exits.

[0034] Furthermore, the first process acquiring the detection task further includes:

[0035] After the first process obtains the detection task, it saves data information of the detection task, where the data information includes the detection item and detection time corresponding to the detection task;

[0036] Furthermore, the first process obtains relevant information of the specified behavior of the specified application based on the detection result of the second process, specifically including:

[0037] The first process receives a third message sent by the second process, and obtains actual detection time and detected content of the detection phase corresponding to the third message;

[0038] The first process takes a screenshot of a specified behavior of the specified application corresponding to the detection task according to the detected content, and saves the screenshot information;

[0039] The first process fills and summarizes the data information of the detection task corresponding to the third message according to the detected content and / or screenshot information, and the actual detection time.

[0040] Furthermore, the application behavior detection method further includes:

[0041] The second process is bound to the system process through the Hook technology.

[0042] In a second aspect, an embodiment of the present invention provides an electronic device, including:

[0043] at least one processor; and

[0044] at least one memory in communication with the processor, wherein:

[0045] The memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the application behavior detection method described in the first aspect of the embodiment of the present invention and the method described in any optional embodiment thereof.

[0046] In a third aspect, an embodiment of the present invention provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions execute the application behavior detection method described in the first aspect of the embodiment of the present invention and the method of any optional embodiment thereof.

[0047] The application behavior detection method provided in an embodiment of the present invention implements application behavior detection through the collaboration of two processes. The first process obtains a detection task and, through message instructions, schedules the second process to perform behavior detection. Based on the behavior detection results of the second process, relevant information about the application's specified behavior is obtained. This embodiment of the present invention is an automated detection method that, through the control of detection tasks, enables automated, comprehensive, and accurate application behavior detection. This method addresses the shortcomings of current technologies and avoids manual effort. It can detect not only irregular application behavior but also any specified behavior, facilitating reverse engineering and behavior monitoring of applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0049] Figure 1 This is a flow chart of a method for detecting application behavior according to an embodiment of the present invention;

[0050] Figure 2 This is a flow chart of interaction during local detection according to an embodiment of the present invention;

[0051] Figure 3 This is a flow chart of the remote control detection process according to an embodiment of the present invention;

[0052] Figure 4 This is a schematic diagram of an application behavior detection device according to an embodiment of the present invention;

[0053] Figure 5 Schematic diagram of the framework of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0054] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0055] Figure 1 FIG. 1 is a flow chart of an application behavior detection method according to an embodiment of the present invention. Figure 1 The application behavior detection method shown is executed by a smart terminal and includes:

[0056] 100. The first process obtains a detection task, where the detection task is a task for detecting a specified behavior of a specified application program.

[0057] 101. The second process detects a specified behavior of the specified application according to a message instruction of the first process.

[0058] 102. The first process obtains information related to a specified behavior of the specified application according to a detection result of the second process.

[0059] In the embodiments of the present invention, the first process and the second process are two different processes running on the same intelligent terminal. The first process acquires detection tasks, performs task analysis and scheduling, and finally collects and summarizes the detection results. The second process performs behavior detection based on the scheduling (message instructions) of the first process. Therefore, in the embodiments of the present invention, the first process is also referred to as the link end or the first link end process, and the second process is also referred to as the detection end or the second detection end process. It should be noted that in the embodiments of the present invention, the first, second, or third are used only for name distinction and have no substantive meaning.

[0060] The link end is the entrance to the application to be detected, and the detection task is obtained through the first process of the link end; the detection task of the embodiment of the present invention is a task to detect the specified behavior of the specified application, that is, to detect whether the application has the specified behavior; specifically, the data information of the detection task may include one or more of the sample file path, package name, program name, task ID, detection item and detection time.

[0061] After receiving the detection task, the first process on the link side analyzes it and schedules and manages it using a message-driven approach. The message sent by the first process on the link side is a global message, received by both the first process on the link side and the second process on the detection side. This global message drives the first process on the link side to manage the detection phase, instructing the second process on the detection side to execute the detection task. The second process on the detection side executes or stops the detection task based on the message from the first process on the link side and provides feedback to the first process on the link side.

[0062] The designated behaviors described in the embodiments of the present invention can include irregular application behavior, privacy-related behavior, data usage behavior, and so on. Any normal or abnormal behavior falls within the designated behaviors of the embodiments of the present invention. By detecting normal and abnormal application behavior, it is possible to monitor application behavior and facilitate reverse engineering analysis. Abnormal behavior can be further addressed through exception handling, etc., although this is not limited in the embodiments of the present invention.

[0063] The application behavior detection method provided by an embodiment of the present invention implements behavior detection of an application through the collaboration of two processes. The first process obtains a detection task and, through message instructions, schedules the second process to perform behavior detection. Based on the behavior detection results of the second process, relevant information about the application's specified behavior is obtained. This embodiment of the present invention is an automated detection method that, through the control of detection tasks, enables automated, comprehensive, and accurate behavior detection, addressing the shortcomings of current technologies and avoiding manual effort. It can detect not only irregular application behavior but also any specified behavior, facilitating reverse engineering and behavior monitoring of applications.

[0064] Based on the above embodiment, in the embodiment of the present invention, the second process of the detection end is bound to the system process through the Hook technology.

[0065] When the smart terminal starts up, the second process on the detection side of this embodiment of the present invention binds to the system process and simultaneously starts the first process on the link side. In this embodiment of the present invention, the second process on the detection side hooks into the system, while the first process on the link side performs self-control and completes the scheduling and management of detection tasks. The two processes are interdependent. Because the second process on the detection side is bound to the system process and kept alive, it has strong stability, and its lifecycle is guaranteed to be synchronized with the system. Accordingly, the second process on the detection side can receive messages at any time, facilitating application behavior simulation and the execution of detection tasks, greatly improving the accuracy of detection and the reliability of the detection method.

[0066] Different from the traditional method of multiple services calling each other and keeping invisible pages alive, the embodiment of the present invention binds the life cycle of the second process of the detection end to the system process, improves the survival cycle and can execute tasks globally. At the same time, it saves global messages in a unified memory space for global use, providing guarantees for the normal, long-term and stable execution of tasks and in-depth detection.

[0067] Based on any of the above embodiments, step 100, in which the first process obtains the detection task, specifically includes: the first process reads a local file and obtains the detection task from the local file; or the first process receives the detection task sent by the server; wherein the designated application corresponding to the detection task is an installed application or an uninstalled application.

[0068] After the first process on the link side of the embodiment of the present invention is started, the detection task can be obtained in two ways:

[0069] First, obtain the detection task from the local file, corresponding to the local detection; specifically, during local detection, the first process on the link end will autonomously search for the local application and perform automatic detection on it.

[0070] Second, it receives testing tasks sent by the server, corresponding to remote control testing. Specifically, during remote control testing, the server is configured and communicates with a smart terminal, which is another smart terminal. The first process on the smart terminal will download and install the application according to the server's instructions, begin testing the specified test items, and uninstall the application after the test is completed. At the same time, the first process on the link side also controls the testing process, controlling the testing phase through message transmission.

[0071] The embodiments of the present invention can perform local detection, remote control detection, or both. Preferably, the local detection in the embodiments of the present invention can pre-define a detection process; if a server is configured, the link end can use a technology keep-alive method to receive server messages for a long time and continuously execute automated task allocation.

[0072] In this embodiment of the present invention, the first process of the link end is divided into two types: local detection and remote control detection. The difference lies in the task source and result processing. The specified application in the acquired detection task can be an installed application or an installation package. Optionally, if it is an installation package, the installation package MD5 is verified to ensure that the task is executed correctly. After that, the installation information is packaged with intent and startActivity is called to install it. The installation behavior is confirmed by a simulated click.

[0073] Based on any of the above optional embodiments, in step 100, the first process acquires the detection task further comprising:

[0074] After the first process obtains the detection task, it saves data information of the detection task, where the data information includes the detection item and detection time corresponding to the detection task;

[0075] As previously described, the data information of a detection task in an embodiment of the present invention may include one or more of the following: sample file path, package name, program name, task ID, current detection item, and detection time. After the first process on the link side obtains the detection task, it may encapsulate the package name, program name, task ID, detection item, and detection time into serialized data and save the detection task information. The saved data information will be populated during the subsequent detection process, thereby obtaining complete task data and detection data. The first process on the link side then initiates detection phase management and performs detection task scheduling.

[0076] Based on any of the above optional embodiments, in step 101, the second process detects a specified behavior of the specified application according to a message instruction of the first process, and the step also includes:

[0077] The first process obtains one or more detection items and a detection time corresponding to each detection item according to the detection task;

[0078] The first process maintains a timer based on the acquired detection items and detection time, and configures a detection phase for each detection item;

[0079] Based on the detection stage corresponding to any detection item of the detection task, the first process sends a first global message or a second global message, wherein the first global message is used to indicate the start of detection of any detection item, and the second global message is used to indicate the end of detection of any detection item.

[0080] In an embodiment of the present invention, a detection task corresponds to one or more detection items, and each detection item may correspond to one or more detection times. For different types of applications, different specified behaviors have different characteristics and manifestations of their behaviors. A set of default detection item processes can be set for the specified behaviors of one or several types of applications as the detection process for the specified behaviors of such applications; another set of default detection item processes can be set for the specified behaviors of another or several other types of applications as the detection process for such applications; at the same time, local detection can also customize the detection process; the above specific detection processes are not limited by the embodiments of the present invention.

[0081] At the start of a detection task, the first process on the link side maintains a timer based on the detection item and the detection time to manage the detection phases. This timer determines the detection phases based on the duration of each detection item. Based on the timer, the first process on the link side sends different messages to notify the second process on the detection side to start or end a detection phase. The first process on the link side sends two global messages, the first global message and the second global message, to indicate the start or end of detection for a specific detection item, respectively. All global messages are received simultaneously by the first process on the link side and the second process on the detection side.

[0082] It should be noted that during remote control detection, a long connection heartbeat detection mechanism can be configured between the server and the smart terminal. By regularly making network requests to the smart terminal link end and cooperating with the link end's timer to manage the task process, it can be confirmed whether the task is executed normally.

[0083] Based on any of the above optional embodiments, in step 101, the second process detects the specified behavior of the specified application according to the message instruction of the first process, specifically including:

[0084] 101.1. If the second process receives the first global message, the second process hooks the page creation method of the specified application and simulates clicks on the page of the specified application to traverse the page operations; the second process obtains the page information of each refresh as the data to be detected; based on the detection stage corresponding to the first global message, the second process performs behavior detection based on the data to be detected; or

[0085] 101.2. If the second process receives the second global message, it ends the detection of the specified application and sends a third message to the first process. The third message includes the actual detection time and detection content of the detection phase corresponding to the second global message.

[0086] In this embodiment of the present invention, the second process on the detection side performs different operations based on the different detection stages corresponding to the global message, completing an automated simulated manual detection. It also sends the detected behavior data to the first process on the link side via a message. The second process on the detection side also maintains the received global message to achieve process synchronization.

[0087] Step 101.1: For a specific detection phase, the second process of the detection end receives the first global message and starts to perform detection for the detection phase. The detection method of the second process of the detection end includes:

[0088] First, the second process on the detection side hooks the page creation method of the specified application, obtains the fully rendered page information, parses and encapsulates it, and obtains the digitized information of each control with clear hierarchy and complete content. It should be noted that if the page creation method of the specified application corresponding to the detection task has been hooked during the initial detection phase of a detection task, this step can be omitted in subsequent detection phases of the same detection task.

[0089] Secondly, the second process on the detection end simulates clicks on the pages of the specified application to traverse the page operations. In this embodiment of the present invention, the second process on the detection end is bound to the system process, hooks the valid pages of the specified application, simulates clicks according to the detection process of the detection phase corresponding to the first global message, completes an orderly and recorded traversal operation, browses all or part of the pages of the specified application, triggers all or part of the behavior of the specified application, and captures the information data of each valid page, thereby achieving the detection purpose.

[0090] For each refreshed page, the second process obtains the page information for each refresh and encapsulates the obtained page information as the data to be tested. Typically, application pages contain one or more of the following information: text, images, links, controls, etc. The encapsulated data to be tested also contains information related to the location and properties of the text, images, links, or controls actually contained on the page.

[0091] Subsequently, the second process on the detection end performs behavioral detection based on the data to be detected, focusing on whether the data to be detected contains the specified detection content. If so, it is marked as valid data and further analysis begins. Otherwise, the information obtained from this page update is discarded. In this embodiment of the present invention, the specified detection content can be indicated by a global message sent by the first process on the link end. For example, the specified detection content can be included in the detection item corresponding to the first global message. Of course, the detection item can also include other data, which is not limited in this embodiment of the present invention.

[0092] In the embodiment of the present invention, the second process of the detection end hooks the valid pages of the specified application, captures the data of each valid page and encapsulates it for analysis, and can filter the valid data for analysis based on the instructions sent by the first process of the link end; at the same time, the embodiment of the present invention realizes the simulated click operation across processes without root privileges, and combines the globally saved information to realize the "ordered and recorded" intelligent traversal operation, comprehensively detects the target, and greatly improves the accuracy of detection and the reliability of the detection method.

[0093] In step 101.2, for a specific detection phase, the second detection process receives a second global message, ending detection for that phase. If the second detection process detects a specified behavior during that phase, it sends a message to the first link process, including the detection details of the specified behavior and the actual detection time for that phase, for the first link process to process as evidence and ensure detection reliability. This third message can be a global message or a message sent directly to the first process.

[0094] Based on any of the above optional embodiments, in step 101.1, the second process hooks the page creation method of the specified application and simulates clicks on the page of the specified application to traverse the page operation, further comprising:

[0095] The second process obtains an input instruction;

[0096] The second process executes one or more Hook events according to the input instruction.

[0097] In an embodiment of the present invention, the second process of the detection end can also receive user input instructions. The user can independently select events such as URL records, traffic usage or privacy access that need to be hooked to achieve deeper detection; the second process of the detection end performs Hook operations according to the user's input instructions.

[0098] In the embodiment of the present invention, the Hook events include, but are not limited to, URL logging, traffic usage, private access, new page creation, page content refresh, broadcast transmission and reception, and message notifications. Based on each Hook event, or a combination of multiple Hook events, or a combination of Hook events and other data, it is possible to analyze and detect different behaviors of an application, as briefly explained below:

[0099] Hook URL records can be combined with link addresses to analyze the purpose of the application jumping to the web page. For example, when the application is running, a browser is started. The browser browsing address that is hooked can be used to analyze the jump behavior.

[0100] Hook traffic usage and combine it with the application type to analyze application data usage. For example, if a text reading application suddenly consumes a lot of traffic, it may be an update or an unrelated download.

[0101] Hook privacy access to analyze whether apps read users' private information. Combined with the app's privacy terms, analyze app compliance. For example, news apps read irrelevant user information such as contact lists.

[0102] Hooking new page creation and page content refresh can combine the previous page and the operation that triggered the creation event to analyze the new page scenario. For example, clicking a button, triggering a pop-up window unrelated to the application, or a jump can determine the nature of the current page change.

[0103] Hooking broadcasts and message notifications allows you to determine the triggering conditions and message types based on the current operation. For example, clicking a button while the app is running may trigger a download and a broadcast notification, or the app notification may contain irrelevant content.

[0104] The above description is merely an example and is not exhaustive or limiting. Application behavior analysis can be performed in conjunction with the above data analysis to achieve detection purposes. The embodiments of the present invention do not limit the specific specified behaviors and Hook events, or the relationship between the specified behaviors and Hook events.

[0105] Based on any of the above optional embodiments, in step 101.1, the second process hooks the page creation method of the specified application and simulates clicks on the page of the specified application to traverse the page operation, further comprising:

[0106] The second process records information about the current page of the simulated click and the clicked control to ensure that the page can be returned to after the jump occurs, thereby completing the page traversal operation.

[0107] In the embodiment of the present invention, each click during the second process traversal process of the detection end will record the complete information of the current click window and the click control to ensure that a jump occurs. Regardless of whether the jump is to a page within the application or other processes, it will be guaranteed to return to the current page until the control traversal of this page is completed, thereby ensuring the reliability of the detection.

[0108] Based on any of the above optional embodiments, in step 101.1, based on the detection phase corresponding to the first global message, the second process performs behavior detection based on the data to be detected, specifically including:

[0109] The second process filters the data to be detected according to the detection phase corresponding to the first global message to obtain filtered data to be detected;

[0110] If the filtered data to be detected contains the specified detection content, the second process performs behavior analysis and detection on the filtered data to be detected to detect the specified behavior of the specified application.

[0111] In this embodiment of the present invention, the second process on the detection end simulates click-through page traversal to obtain page information from each refresh, which serves as the data to be detected. This data is digitized information of the page with clear hierarchy and complete content. Because different detection phases detect different specific detection items, the second process on the detection end filters the data to be detected based on the detection phase corresponding to the global message sent by the first process on the link end, obtaining the data to be detected that meets the requirements of the current detection phase, i.e., the filtered data to be detected.

[0112] In this embodiment of the present invention, the first process on the link side sends different messages at different detection stages, such as when detecting when a specified application is running, when a specified application is switched to the background, and when a specified application is exiting. The second process on the detection side uses these detection stages to distinguish detection content, perform information filtering, and analyze the window data of the specified application. Similarly, the page traversal process relies on this data.

[0113] If the filtered data to be detected contains the designated detection content of the current detection stage, the filtered data to be detected is further analyzed and detected to achieve detection of the designated behavior of the designated application.

[0114] The second process of the embodiment of the present invention performs behavioral analysis and detection on the filtered data to be detected, specifically including:

[0115] The second process performs one or more of in-application detection, background detection, and out-application detection on the specified behavior of the specified application based on the filtered data to be detected;

[0116] The in-application detection refers to the detection of specified behaviors that occur during the operation of the application; the background detection refers to the detection of specified behaviors that occur during the background operation when the application switches to the background; the out-application detection refers to the detection of specified behaviors related to the application after the application exits.

[0117] It should be noted that when detecting different specified behaviors of an application, the specific detection contents corresponding to in-app detection, background detection, and out-of-app detection may be the same or different. For example, when detecting irregular behavior of an application, the optional detection contents are as follows:

[0118] 1. In-app detection: such as launching an application silently, launching an application with a click based on a specified usage strategy (i.e., a destination query click), launching an application with a click based on a random entry (i.e., an ordered click without a destination), etc.

[0119] 2. Background detection: such as switching the application to the background for silent processing, returning to the desktop icon query, opening the notification bar to view messages, etc.

[0120] 3. Detection outside the application: For example, exit the application and check whether there is a self-wake-up function.

[0121] These respectively correspond to runtime detection, which detects irregularities that occur during application operation, such as banner ad pop-ups; background state detection, which detects irregularities that occur when the application switches to the background, such as background ad pop-ups; and closed state detection, which detects irregularities that occur after exiting the application, such as self-starting pop-ups. The detection results of each stage are encapsulated into serialized data by the second process on the detection end. This data provides a detailed description of the irregularity, including the detected items and the time of detection. This data is then sent to the first process on the connection end.

[0122] Based on any of the above optional embodiments, step 102, in which the first process obtains information related to the specified behavior of the specified application based on the detection result of the second process, specifically includes:

[0123] The first process receives a third message sent by the second process, and obtains actual detection time and detected content of the detection phase corresponding to the third message;

[0124] The first process takes a screenshot of a specified behavior of the specified application corresponding to the detection task according to the detected content, and saves the screenshot information;

[0125] The first process fills and summarizes the data information of the detection task corresponding to the third message according to the detected content and / or screenshot information, and the actual detection time.

[0126] After the first process at the link end of the embodiment of the present invention receives the message from the second process at the detection end, it obtains information such as the actual detection time and detected content contained in the message. Based on the detection item information received in the detection stage, it can call the system mediaproject function to take a screenshot of the detected content as evidence and save the information.

[0127] After the detection task is completed, the first process on the link end fills in the data information saved at the beginning of the detection task, summarizes the data, including the actual detection time, detected items, and abnormal information during the detection process, thereby completing the detection task and saving the final results locally or uploading them to the server.

[0128] In an optional embodiment, during local detection, the first process on the link end saves the local image and txt file; during remote control detection, the first process on the link end uploads the image and the encapsulated serialized data to the server.

[0129] In summary, the application behavior detection method provided by the embodiment of the present invention realizes the behavior detection of the application through the collaboration of two processes. The first process obtains the detection task and schedules the second process to perform behavior detection through message instructions, and obtains the relevant information of the specified behavior of the application based on the behavior detection result of the second process. The embodiment of the present invention is an automated detection method. By controlling the detection task, it can realize automated, comprehensive and accurate application behavior detection, which can make up for the shortcomings of current technology and avoid manual waste. It can not only detect the irregular behavior of the application, but also detect any specified behavior, such as privacy behavior, traffic usage behavior, and any normal or abnormal behavior, which is conducive to reverse analysis and behavior monitoring of the application.

[0130] The embodiment of the present invention can perform local detection or remote control detection, or perform local detection and remote control detection simultaneously.

[0131] Figure 2 This is a flow chart of the local detection process in the embodiment of the present invention. Figure 2 In the embodiment of the application behavior detection method shown, during local detection, the first process obtains the detection task from the local file; then the detection task is analyzed, the detection items and detection time are obtained, a timer is maintained, and the detection stage management of the detection task is performed; the detection task is started, and a first global message is sent, and this first global message is received by the second process and the first process at the same time; the second process executes the detection task according to the received first global message; the first process executes the detection task stage management according to the received first global message, and sends a second global message, and this second global message is received by the second process and the first process at the same time; the first process receives the second global message, and sends the detection content and actual detection time to the first process through a third message; the first process fills and organizes the data information of the detection task according to the received detection content and actual detection time, and executes the detection task stage management according to the received second global message, and starts the next detection stage until all detection stages are completed; when all detection tasks are completed, the first process summarizes the data information and takes screenshots for evidence, etc., and saves them locally.

[0132] Figure 3 This is a flow chart of remote control detection in an embodiment of the present invention. It should be noted that the first process and the second process are two processes running on the same smart terminal, and the server is another smart terminal. Figure 3In the embodiment of the application behavior detection method shown, a first process requests a detection task from a server; the server sends the detection task to the first process; after receiving the detection task sent by the server, the first process analyzes the detection task, obtains the detection items and detection time, maintains a timer, and performs detection phase management for the detection task; starts the detection task and sends a first global message, which is received simultaneously by the second process and the first process; the second process executes the detection task based on the received first global message; the first process performs detection task phase management based on the received first global message and sends a second global message, which is received simultaneously by the second process and the first process; the first process receives the second global message and sends the detection content and actual detection time to the first process via a third message; the first process fills and organizes the data information of the detection task based on the received detection content and actual detection time, and performs detection task phase management based on the received second global message, starting the next detection phase, until all detection phases are completed; when all detection tasks are completed, the first process summarizes the data information and takes screenshots for evidence; the second process uploads the organized detection results to the server and / or saves them locally. At this point, one detection task is completely completed, and the first process can request the next detection task and wait.

[0133] This embodiment of the present invention binds the detection end process that performs application behavior detection to the system process, allowing it to hook valid page data and encapsulate and analyze it. This embodiment of the present invention uses the detection end process to hook a large number of valid application pages, capturing information and data from each page. For each refreshed page, detailed information is extracted and encapsulated as test data, significantly improving detection accuracy and reliability.

[0134] This embodiment of the present invention maintains activity by hooking into the system process. Unlike traditional methods of invoking multiple services and maintaining invisible pages for activity, this embodiment binds the lifecycle of the detection end process to the system process, extending its lifespan and enabling global task execution. It also stores global messages in a unified memory space for global use, ensuring stable, long-term task execution and in-depth detection.

[0135] The embodiment of the present invention completes the simulated click operation across processes without the need for root privileges, realizes the "orderly and recorded" intelligent traversal operation in combination with the globally saved information, and comprehensively detects the target.

[0136] Based on the above characteristics, the embodiment of the present invention detects the behavior of the application program, has high detection accuracy, strong executability and high data security, ensures the reliability and comprehensiveness of the behavior detection, and has good beneficial effects.

[0137] Figure 4Schematic diagram of an application behavior detection device according to an embodiment of the present invention. The embodiment of the present invention also provides an application behavior detection device, such as Figure 4 As shown, it includes a detection task acquisition module 400, a behavior detection module 401 and a detection result summary module 402:

[0138] A detection task acquisition module 400, in which a first process acquires a detection task, wherein the detection task is a task for detecting a specified behavior of a specified application program;

[0139] Behavior detection module 401, the second process detects the specified behavior of the specified application according to the message instruction of the first process;

[0140] In the detection result aggregation module 402 , the first process obtains information related to the specified behavior of the specified application program based on the detection result of the second process.

[0141] The application behavior detection device according to the embodiment of the present invention is used to perform Figure 1 The technical solution of the application behavior detection method embodiment shown has similar implementation principles and technical effects, which will not be repeated here.

[0142] Figure 5 This is a schematic diagram of the electronic device framework according to an embodiment of the present invention. Figure 5 An embodiment of the present invention provides an electronic device, comprising: a processor 510, a communications interface 520, a memory 530, and a bus 540, wherein the processor 510, the communications interface 520, and the memory 530 communicate with each other via the bus 540. The processor 510 can call logic instructions in the memory 530 to execute the following method, including: a first process obtaining a detection task, wherein the detection task is a task for detecting a specified behavior of a specified application; a second process detecting the specified behavior of the specified application according to a message instruction of the first process; and the first process obtaining relevant information about the specified behavior of the specified application according to the detection result of the second process.

[0143] An embodiment of the present invention discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the methods provided by the above-mentioned method embodiments, for example, including: a first process obtains a detection task, and the detection task is a task of detecting a specified behavior of a specified application; a second process detects the specified behavior of the specified application according to a message indication of the first process; and the first process obtains relevant information of the specified behavior of the specified application according to the detection result of the second process.

[0144] An embodiment of the present invention provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions enable the computer to execute the methods provided by the above-mentioned method embodiments, for example, including: a first process obtains a detection task, and the detection task is a task of detecting a specified behavior of a specified application; a second process detects the specified behavior of the specified application according to a message indication of the first process; and the first process obtains relevant information of the specified behavior of the specified application according to the detection result of the second process.

[0145] Those skilled in the art will appreciate that the implementation of the above-described device or method embodiments is merely illustrative, wherein the processor and the memory may or may not be physically separate components, i.e., they may be located in the same location or distributed across multiple network elements. Some or all of these modules may be selected based on actual needs to achieve the objectives of the present embodiments. Those skilled in the art will be able to understand and implement these embodiments without inventive effort.

[0146] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the above technical solution, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product, which can be stored in a computer-readable storage medium, such as a USB flash drive, a mobile hard disk, ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiment.

[0147] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for detecting application behavior, characterized in that: include: The first process acquires a detection task, where the detection task is a task for detecting a specified behavior of a specified application program; The second process detects a specified behavior of the specified application according to the message instruction of the first process; The first process obtains relevant information of the specified behavior of the specified application according to the detection result of the second process; The second process detects a specified behavior of the specified application according to a message instruction from the first process, and the method further includes: The first process obtains one or more detection items and a detection time corresponding to each detection item according to the detection task; The first process maintains a timer based on the acquired detection items and detection time, and configures a detection phase for each detection item; Based on a detection phase corresponding to any detection item of the detection task, the first process sends a first global message or a second global message, wherein the first global message is used to indicate a start of detection of the any detection item, and the second global message is used to indicate an end of detection of the any detection item; The second process detects a specified behavior of the specified application according to the message instruction of the first process, specifically including: If the second process receives the first global message, the second process hooks the page creation method of the specified application and simulates clicks on the page of the specified application to traverse page operations; the second process obtains page information of each refresh as data to be detected; based on the detection phase corresponding to the first global message, the second process performs behavior detection based on the data to be detected; or If the second process receives the second global message, it ends the detection of the specified application and sends a third message to the first process. The third message includes the actual detection time and detection content of the detection phase corresponding to the second global message.

2. The method according to claim 1, characterized in that The first process acquires the detection task, specifically including: The first process reads a local file and obtains a detection task from the local file; or the first process receives a detection task sent by the server; The designated application corresponding to the detection task is an installed application or an uninstalled application.

3. The method according to claim 1, characterized in that The second process hooks the page creation method of the specified application and simulates clicks on the page of the specified application to traverse the page operation, and further includes: The second process obtains an input instruction; The second process executes one or more Hook events according to the input instruction.

4. The method according to claim 3, characterized in that The second process hooks the page creation method of the specified application and simulates clicks on the page of the specified application to traverse the page operation, and further includes: The second process records information about the current page of the simulated click and the clicked control to ensure that the page can be returned to after the jump occurs, thereby completing the page traversal operation.

5. The method according to claim 4, characterized in that In the detection phase corresponding to the first global message, the second process performs behavior detection according to the data to be detected, specifically including: The second process filters the data to be detected according to the detection phase corresponding to the first global message to obtain filtered data to be detected; If the filtered data to be detected contains the specified detection content, the second process performs behavior analysis and detection on the filtered data to be detected to detect the specified behavior of the specified application.

6. The application behavior detection method according to claim 5, characterized in that: The second process performs behavioral analysis and detection on the filtered data to be detected, specifically including: The second process performs one or more of in-application detection, background detection, and out-application detection on the specified behavior of the specified application based on the filtered data to be detected; The in-application detection refers to the detection of specified behaviors that occur during the operation of the application; the background detection refers to the detection of specified behaviors that occur during the background operation when the application switches to the background; the out-application detection refers to the detection of specified behaviors related to the application after the application exits.

7. The method according to claim 5, characterized in that The first process acquisition detection task further includes: After acquiring the detection task, the first process saves data information of the detection task, where the data information includes the detection items and detection time corresponding to the detection task.

8. The method according to any one of claims 1 to 6, characterized in that The first process obtains, based on the detection result of the second process, information related to the specified behavior of the specified application program, specifically including: The first process receives a third message sent by the second process, and obtains actual detection time and detected content of the detection phase corresponding to the third message; The first process takes a screenshot of a specified behavior of the specified application corresponding to the detection task according to the detected content, and saves the screenshot information; The first process fills and summarizes the data information of the detection task corresponding to the third message according to the detected content and / or screenshot information, and the actual detection time.

9. The method according to any one of claims 1 to 7, characterized in that The application behavior detection method further includes: The second process is bound to the system process through the Hook technology.

10. An electronic device, characterized in that: include: at least one processor; as well as at least one memory in communication with the processor, wherein: The memory stores program instructions that can be executed by the processor, and the processor can execute the method according to any one of claims 1 to 9 by calling the program instructions.

11. A non-transitory computer-readable storage medium, characterized in that The non-transitory computer-readable storage medium stores computer instructions, and the computer instructions enable the computer to execute the method according to any one of claims 1 to 9.

Images